Hey friends. I've been tasked to update the SSL Cert on one of our RHEL 7.6 VMs that runs httpd (Apache web server) for an internally used web app. The CA verified and signed the cert before I took over for the previous engineer who had my job and I've looked at a lot of tutorials to deploy SSL/TLS on RHEL 7, but I've got a messy situation and I haven't quite figured it out how to handle this issue...

My manager gave me a .crt file and after I swapped it out for the old .crt file, httpd wouldn't start due to a key mismatch. I can see by the message in the ssl error log that mod_ssl won't start and therefore prevents httpd from starting. I know the private that was generated when the CSR was generated should be on the system but I can't locate it. Is there a way to regenerate a (missing) private key from a .crt file? Thanks.

Several links here that might be useful.

Can you regenerate the original key from a .crt, generally no. .crt files USUALLY have JUST the certificate in them which includes the PUBLIC key. The private key is usually in a keyfile (as you know).

To my knowledge, you're only real option if you can't find it is to create a NEW keypair and create a new CSR using that keypair to rekey the cert, that's the only thing I'm aware of that you'd be able to do if you can't find the existing key.

1 members found this post helpful.

No, cannot reproduce a private key - this is by design. Sorry...

EDIT - if you have a pkcs12 file which is a binary file and has the public and private, yes, you can extract the private if you know the password to the file, but if you only have the base64 encoded public key and original request but not the private, I am afraid not.

1 members found this post helpful.

Thanks for all the helpful information!